Convert fields created by grok pattern as integer

[ndelle (Nahuel)]

Hi! I have been making some great improvements with graylog. I am using grok extractors to get the data from Haproxy and Apache logs but my problem is that i am getting fields that are numbers (response times) as string so i can’t make some graph (for instance i want to create a graph of average response time). This is my grok pattern:

%{IPV4:clientip}:%{POSINT:clientport} [%{HAPROXYDATE:accept_date}] %{NOTSPACE:frontend_name} %{NOTSPACE:backend_name}/%{NOTSPACE:server_name} %{NUMBER:time_request}/%{NUMBER:time_queue}/%{NUMBER:time_backend_connect}/%{NUMBER:time_backend_response}/%{NOTSPACE:time_duration} %{NUMBER:http_status_code} %{NOTSPACE:bytes_read} %{DATA:captured_request_cookie} %{DATA:captured_response_cookie} %{NOTSPACE:termination_state} %{NUMBER:actconn}/%{NUMBER:feconn}/%{NUMBER:beconn}/%{NUMBER:srvconn}/%{NOTSPACE:retries} %{NUMBER:srv_queue}/%{NUMBER:backend_queue} {%{HAPROXYCAPTUREDREQUESTHEADERS}} “(|(%{WORD:http_verb} (%{URIPROTO:http_proto}://)?(?:%{USER:http_user}(?::[^@]*)?@)?(?:%{URIHOST:http_host})?(?:%{URIPATHPARAM:http_request})?( HTTP/%{NUMBER:http_version})?))?”

How can i convert created fields created by grok pattern extractors from string to number/int/long?

Edit: As far as i read i should create a new index via graylog, can i do this? Even more, can i create an index with fields that will be populated later with an extractor?

[Arvo]

@ndelle

%{NUMBER:time_backend_response}

Try to change it to something like:
%{NUMBER:time_backend_response; float}
Also short, long, double, int and other data types can be used, but it won’t work for existing indice - meaning, if Graylog rotates indices each day, then result could be tomorrow (or after manual rotation) and only for data imported after rotation.
Theoretically it shall work
Another working approach could be to describe fields and data types in source host log collector config (e.g. nxlog) and feed data to Graylog in Gelf format.

[ndelle (Nahuel)]

@Arvo

if Graylog rotates indices each day, then result could be tomorrow (or after manual rotation) and only for data imported after rotation

Made the change, now i am looking for a way to manually rotate the log and force the creation of a new index

Update: Ok, i rotated the log and it seems that is working, i will make some more test today and let you know. Thanks for the quick response!